marc4 vulnerabilities and threats

The Security Hardener plugin for WordPress versions up to and including 2.4.4 contains an authorization bypass vulnerability. This flaw arises because the plugin overwrites permission callbacks on user-related REST API endpoints, removing WordPress's core capability checks. As a result, authenticated users with Subscriber-level access or higher can create new Administrator accounts or reset passwords of existing Administrators without proper authorization. The vulnerability is active by default due to the enabled user-enumeration protection feature.